Using the private file system as described by @4uk4 is the correct way to secure the files and ensure only the correct users have access.
In addition to this, if you want to improve the convenience of managing files for site administrations (and perhaps users), you can use media entities.
This is more work for the developer to set up but it can standardize processes and make life easier for admins/users.
When you enable the core Media module, a File media entity type is created by default. You can customize this media type by adding additional fields, or you can just use the File media type as is.
When you do it this way:
- You need to create a File media entity for each file.
- To attach files to nodes, instead of a File field that stores the file directly, you use an Entity Reference field to the File media entity type.
As you can see, this adds some additional steps. But, then you get the following benefits:
- Each file has its own entity, so if you need the same file in multiple places, you can link it via entity reference instead of uploading it multiple times.
- You can easily sort files in Views and make views that show files based on various attributes.
- Media entities can store file metadata in fields, which can be filtered in views.
- The media entities can be themed and treated as "pages" (given URLs), so for example you could embed the pdf on the page or customize the download link to add whatever legal disclaimers you need.
